Nmap Basics

In this guided exercise, you will apply what you have learned so far to perform scanning and enumeration using a range of different Nmap options. You will begin by running a host discovery scan on the target network.

Before proceeding, review the questions on the Tasks tab. You will find the answers to these questions as you complete the following steps.

1. In the Node (h1) window, type sudo nmap -sn 192.168.0.0/24 and press Enter to perform host discovery, skipping the port scanning phase (-sn).
   

   

2. In the Node (h1) window, type sudo nmap -sn -reason 192.168.0.0/24 and press Enter to ask Nmap how it determined these hosts were up.
   

   

   Nmap utilizes several techniques for detecting hosts on a network. If running a ping scan (as root) on a local network, Nmap will attempt host discovery using ARP, a protocol that systems on the same network use to determine which MAC address belongs to a particular IP address. It does this by broadcasting to the network (who has this IP and what is your MAC address?). Handy for taking attendance!
   
   Now that you’ve discovered some hosts, it’s time to see if any of them have open ports. With your next scan, you will alter the range of the scan, now that you know the IP addresses available in the network (i.e., all are between 1 and 100).
   
3. In the Node (h1) window, type sudo nmap -Pn 192.168.0.2-100 -F and press Enter to perform a SYN Stealth scan on a smaller target range (excluding your own machine at 192.168.0.1), skipping host discovery (-Pn) and looking only at the top 100 ports (-F).
   

   

   Since you are running Nmap with root privileges, the following command is equivalent: nmap -sS -Pn 192.168.0.2,20. You can also press Enter at any time to see the current progress of the scan.
   
   You skipped the host discovery scan here because you know the host is up. That said, it is common for modern devices to block ping probes, and Nmap will not proceed to the port scanning phase if it fails to discover any live hosts. If you are sure the host is up, but is blocking your ping probes, -Pn is the path forward.
   
   At this point, you have two targets: webserver and fileserver.
   
   Nmap also performs reverse DNS resolution (using the IP address to obtain the Domain Name), and these names can indicate the purpose of the server.
   
   You will start with the fileserver host at 192.168.0.2, which has closed ports – recall this means the ports are reachable, but no services are running on them (see: no firewall). The other target, 192.168.0.20, has the remainder of its ports filtered instead, so may require a more careful touch. You will come back to that later.
   
   Start by enumerating the software and version running on port 21.
   
4. In the Node (h1) window, type sudo nmap -sV 192.168.0.20 -p 21 and press Enter to detect the software and version running on port 21.
   

   

5. In the Node (h1) window, type sudo nmap -O 192.168.0.20 and press Enter to detect the operating system running on this host.
   

   

   If Nmap doesn’t find a high enough match in its database, it will provide a fingerprint (a set of defining characteristics for that host, created from its responses) and urge you to submit it for entry into its official catalog. We encourage you not to waste their time with this one – we promise there are no novel operating systems worth cataloging in this lab.
   
   If you are content with receiving a guess, despite Nmap’s lack of confidence, you can request a list of its best guesses by adding the –osscan-guess option.
   
6. In the Node (h1) window, type sudo nmap -O –osscan-guess 192.168.0.20 and press Enter to force Nmap to guess more aggressively.
   

   

   In your next scan, you will run a scan on all ports to ensure you didn’t miss any. That’s 65535 ports in total – so why don’t you make it go fast.
   
   Like, insanely fast.
   
7. In the Node (h1) window, type sudo nmap -Pn 192.168.0.20 -T5 -p- and press Enter to scan the remaining ports on your target using the Insane (5) timing template.
   
   Note: -p- is shorthand for all ports and is equivalent to -p 1-65535.
   
   Speed means you may miss some things, but it’s common to run a quick scan to start and then set a longer one in the background while you investigate your initial yield. It is also important to consider your goal – if you are attempting to evade defensive detection (such as a red team operative trying to avoid attention from the blue team), you may want to slow down your scan to decrease your risk of detection. If you are a penetration tester, you have no such obligations, and can be as noisy as you want – you just want to enumerate vulnerabilities you can exploit to demonstrate impact.
   
   Well done (we hope)! Now, time to enumerate that fileserver you skipped initially, which you discovered had a service running on port 8080. We’re only giving you a handful of ports to look at here – otherwise this scan could take a while. Only some of these ports are truly open, and it’s your job to determine which. Let's start with a fast scan.
   
8. In the Node (h1) window, type sudo nmap -Pn -T5 192.168.0.2 -p 22,25,1000,2099,8080,8888 and press Enter to scan the ports on the fileserver you discovered.
   
   Are you satisfied with what you see? Some filtered ports (firewall!), others open. Ready to declare victory? Not so fast. It’s possible the filtering mechanism is protecting against denial-of-service attacks or is blocking based on unusual traffic patterns. You may want to slow down the scan to ensure you don’t inadvertently sound the alarm, causing packets to be dropped and limiting the utility of your scans. It may even be a good idea to switch to TCP connect (“full-open”) scans in this case, should those mechanisms not approve of your digital doorbell-ringing via half-open SYN scans.
   
   These are the kind of crossroads you’ll reach when scanning and enumerating unfamiliar networks. Each scan may provide useful information, but not always conclusive. Sometimes you need to synthesize the output of several scans to build an accurate profile of your target. Part of good reconnaissance is knowing how to use your tool, but the larger part is knowing how to read the output and determining next actions based on what it tells you. This is the difference between script kiddies blasting networks and seasoned professionals producing high-fidelity maps of an organization’s infrastructure.
   
9. In the Node (h1) window, type nmap -Pn 192.168.0.2 -T1 -p 22,25,1000,2099,8080,8888 to slow (Polite) scan the target webserver.
   
   Despite a handful of ports, this scan still may take around 1-2 minutes. Press Enter to see the progress.
   
   3 of these ports are open, did you discover which? If so, well done! You’ve fooled a shoddy packet filtering system. Pat yourself on the back.
   

Congratulations, you made it! Welcome to the Nmap club (and you even learned the special (TCP) handshake to get in).

This is just the tip of the Nmap iceberg, but you now have a strong foundation for taking on intermediate and advanced scanning and enumeration techniques (as well as mastering some of the basics of networking, if this is your first Nmap course).

May your scans be fruitful, your enumerations detailed, and your networks secure. Be sure to answer the questions on the Tasks tab, then take a shot at the challenge exercise.